A tokenization platform that wants to operate in a regulated way is not a website with a smart contract: it is seven layers, and the six you cannot see are the ones that decide whether the issuance is legal. This is the full anatomy — the same one we apply in the projects we build.
The seven layers
1. Classification and structuring. What right the token represents and which vehicle issues it. If it is a transferable security, everything else changes: check yours with the MiCA or MiFID II classifier.
2. Registry. For tokenized securities in Spain, the register is administered by an ERIR and is the official source of ownership — not the block explorer.
3. Identity. KYC/KYB and anti-money-laundering integrated into onboarding and into every transfer, not bolted on afterwards.
4. The token. An ERC-20 knows nothing about accredited investors or court freezes. Securities require standards with transfer restrictions such as ERC-3643, where the contract checks identity before moving anything.
5. Offer documentation. A prospectus approved by the regulator or its exemption (offers below EUR 12 million aggregated per issuer or offeror over twelve months, without the EU passport, since June 5, 2026), with warnings and a traceable subscription flow.
6. Custody. Segregated, and with an authorized entity where the asset requires it — we cover this in our guide to crypto-asset custody.
7. Secondary market and reporting. Trading via DLT Pilot Regime infrastructures where applicable, and reporting to the supervisor and the investor from day one.
Build or buy
Building all seven layers from scratch makes sense for infrastructures with a business model of their own; for most issuers and developers, the rational path is a white-label tokenization platform that already ships with registry, identity and compliance integrated, customized under your brand. Within our group we have turned this into a product with Hokenfi, our software for issuing tokenized financial instruments (it is not a regulated entity: the regulated roles are performed by the ERIR and, where the law requires it, an investment firm).
The three costliest mistakes
Starting with the token (layer 4) before classifying the asset (layer 1): the perfect contract for the wrong instrument. Treating KYC as an onboarding formality rather than a condition of every transfer. And confusing the wallet with the register: in tokenized securities, ownership is evidenced by the entry in the DLT system administered by the ERIR (Law 6/2023, Arts. 8, 11 and 13), not by what a wallet or a block explorer shows.
Where to start
If you are evaluating tokenizing an asset or launching your own platform, the right order is: classification, vehicle, and only then technology. That is exactly the blueprint our asset tokenization service starts with — book a call and we will walk it with your case.